docs(docker): flag OS_SECRET_KEY / OS_AUTH_SECRET as required-in-production

Image-level verification of the 12.1 build against postgres showed the
container refuses to boot without OS_SECRET_KEY (LocalCryptoProvider guards
sys_secret/datasource credentials in production). The compose already passed
these through but with empty defaults, so a bare `docker compose up` crashes
mid-boot with no obvious hint. Add a header block + inline REQUIRED markers.

Author: baozhoutao

docker/docker-compose.yml

@@ -1,3 +1,16 @@
+# ===========================================================================
+# ⚠️  REQUIRED in production (image runs with NODE_ENV=production):
+#     - OS_SECRET_KEY  : 32-byte hex, stable across restarts/nodes. Without it
+#                        the container REFUSES TO START (LocalCryptoProvider
+#                        guards sys_secret / datasource credentials). It is NOT
+#                        auto-generated on purpose — a minted-then-lost key would
+#                        make every encrypted value undecryptable.
+#     - OS_AUTH_SECRET : session signing secret; plugin-auth refuses a temporary
+#                        dev secret in production.
+#     Generate each once and keep them:  openssl rand -hex 32
+#     Set them in a .env file next to this compose (or export in the shell):
+#         OS_SECRET_KEY=...   OS_AUTH_SECRET=...
+# ===========================================================================
 services:
   objectos:
     build:
@@ -13,8 +26,8 @@ services:
       OS_PROJECT_ID: ${OS_PROJECT_ID:-}
       OS_ARTIFACT_FILE: ${OS_ARTIFACT_FILE:-/artifacts/objectstack.json}
       OS_BUSINESS_DB_URL: ${OS_BUSINESS_DB_URL:-file:/var/lib/objectos/data.db}
-      OS_SECRET_KEY: ${OS_SECRET_KEY:-}
-      OS_AUTH_SECRET: ${OS_AUTH_SECRET:-}
+      OS_SECRET_KEY: ${OS_SECRET_KEY:-}     # REQUIRED — empty = container won't boot (see header)
+      OS_AUTH_SECRET: ${OS_AUTH_SECRET:-}   # REQUIRED in production (see header)
       OS_CORS_ORIGIN: ${OS_CORS_ORIGIN:-}
       OS_CACHE_DIR: /var/cache/objectos
       PORT: 3000